Hi together,
i've wrote a ClientLoginModule for a J2EE Application based on [1]. It's aquireing a ServiceTicket based on the cached or "manuall" aquired TGT by AS with Username/Password entering. On Windows XP it works fine, it gets the ServiceTicket, encode it and send it to the J2EE Server for validation.
In Windows Vista it don't work complete. Whether i make a manuall authentication with Username/Password an get the TGT it works. But when i use the ticketCache, i can't get a ServiceTicket. I don't know why... I have found this [2] about Vista and Kerberos. But we have a Win2k3 Server, so the AES encryption should not be used. Furthremore i have compared the TGT cache on vista and xp with kerbtray.exe and klist.exe. It looks nearly same.
My Debug Log on Vista is following:
Debug is true storeKey false useTicketCache true useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
KinitOptions cache name is C:\Users\adeg\krb5cc_adeg
Acquire default native Credentials
Obtained TGT from LSA: Credentials:
Credentials acquireServiceCreds: same realm
CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
KrbKdcReq send: kdc=172.20.1.5 UDP:88, timeout=30000, number of retries =3, #bytes=1250
KDCCommunication: kdc=172.20.1.5 UDP:88, timeout=30000,Attempt =1, #bytes=1250
KrbKdcReq send: #bytes read=83
KrbKdcReq send: #bytes read=83
KDCRep: init() encoding tag is 126 req type is 13
KRBError:
The XP log looks following:
Debug is true storeKey false useTicketCache true useKeyTab false doNotPrompt false ticketCache is null isInitiator true KeyTab is null refreshKrb5Config is false principal is null tryFirstPass is false useFirstPass is false storePass is false clearPass is false
Acquire TGT from Cache
KinitOptions cache name is C:\WINDOWS\system32\config\systemprofile\krb5cc_adeg
Acquire default native Credentials
Obtained TGT from LSA: Credentials:
Credentials acquireServiceCreds: same realm
CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
KrbKdcReq send: kdc=172.20.1.5 UDP:88, timeout=30000, number of retries =3, #bytes=1250
KDCCommunication: kdc=172.20.1.5 UDP:88, timeout=30000,Attempt =1, #bytes=1250
KrbKdcReq send: #bytes read=1188
KrbKdcReq send: #bytes read=1188
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
CksumType: sun.security.krb5.internal.crypto.RsaMd5CksumType
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
KrbKdcReq send: kdc=172.20.1.5 UDP:88, timeout=30000, number of retries =3, #bytes=1245
KDCCommunication: kdc=172.20.1.5 UDP:88, timeout=30000,Attempt =1, #bytes=1245
KrbKdcReq send: #bytes read=1178
KrbKdcReq send: #bytes read=1178
EType: sun.security.krb5.internal.crypto.ArcFourHmacEType
EType: sun.security.krb5.internal.crypto.NullEType
KrbApReq: APOptions are 00000000 00000000 00000000 00000000
EType: sun.security.krb5.internal.crypto.DesCbcMd5EType
TEST.DOMAIN is replaced in the log for the real domain...so the hex code could be different the ASCII
This lines in vista logs confuses me a little:;
>>> KrbKdcReq send: #bytes read=83
KrbKdcReq send: #bytes read=83
Are the size of TGT realy 83 bytes? Or do i missunderstand these lines?
Any ideas where the difference between XP and Vista?
[1]:=http://java.sun.com/j2se/1.4.2/docs/guide/security/jgss/tutorials/index.html
[2]:=http://technet.microsoft.com/en-us/library/cc749438.aspxDebug is true storeKey false useTicketCache true useKeyTab false
Edited by: noFreak on Nov 17, 2008 10:50 AM